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Period for Reply 

A SHORTENED STATUTORY PERIOD FOR REPLY IS SET TO EXPIRE 3 MONTH(S) FROM 
THE MAILING DATE OF THIS COMMUNICATION. 

- Extensions of time may be available under the provisions of 37 CFR 1 .136(a). In no event, however, may a reply be timely filed 
after SIX (6) MONTHS from the mailing date of this communication. 

- If the period for reply specified above is less than thirty (30) days, a reply within the statutory minimunn of thirty (30) days will be considered timely. 

- If NO period for reply is specified above, the maximum statutory period will apply and will expire SIX (6) MONTHS from the mailing date of this communication. 

- Failure to reply within the set or extended period for reply will, by statute, cause the application to become ABANDONED (35 U.S.C. § 1 33). 
Any reply received by the Office later than three months after the mailing date of this communication, even if timely filed, may reduce any 
earned patent temn adjustment. See 37 CFR 1 .704(b). 

Status 

1 )^ Responsive to connnnunication(s) filed on 15 May 2001 , 
2a)n This action is FINAL. 2b)^ This action is non-final. 

3) n Since this application is in condition for allowance except for formal matters, prosecution as to the merits is 

closed in accordance with the practice under Ex parte Quayle, 1935 CD. 1 1 , 453 O.G. 213. 

Disposition of Claims 

4) ^ Claim(s) 1-20 is/are pending in the application. 

4a) Of the above claim(s) is/are withdrawn from consideration. 

5) 0 Claim(s) is/are allowed, 

6) M Claim(s) 1-20 is/are rejected. i 

7) n Claim(s) is/are objected to. | 

8) 0 Claim(s) are subject to restriction and/or election requirement. | 

Application Papers 

9) n The specification is objected to by the Examiner. : 

10) 0 The drawing(s) filed on is/are: a)D accepted or b)^ objected to by the Examiner. 

Applicant may not request that any objection to the drawing(s) be held In abeyance. See, 37 CFR 1 .85(a). 
Replacement drawing sheet(s) including the correction Is required if the drawing(s) is objected to. See 37 CFR 1.121 (d). 

1 1) 0 The oath or declaration is objected to by the Examiner. Note the attached Office Action or form PTO-152, 

Priority under 35 U.S.C. § 119 

12) 0 Acknowledgment is made of a claim for foreign priority under 35 U.S.C. § 119(a)-{d) or (f). 
a)0 All b)0 Some * c)D None of: 

1 .0 Certified copies of the priority documents have been received. 

2.0 Certified copies of the priority documents have been received in Application No. . 

3.0 Copies of the certified copies of the priority documents have been received in this National Stage 
application from the International Bureau (PCT Rule 17.2(a)). 
* See the attached detailed Office action for a list of the certified copies not received. 
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DETAILED ACTION 

1. Claims 1-20 have been examined. 

Priority 

2. This application claims priority to U.S. provisional applications: 60/231 ,480, filed 
Septembers, 2000, 60/231,481, filed Septembers, 2000, and 60/231,479. filed 
September 8, 2000. Thus, the effective filing date for the subject matter defined in the 
pending claims in this application is 09/08/2000. 

Claim Rejections - 35 USC § 103 

3. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject nnatter sought to be patented and 
the prior art are such that the subject nnatter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

4. Claims 1-3,6,8-11, 14, and 16-20 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Soha (U.S, 4,817,080), hereinafter referred to as Soha, in view of 
Smith, R. N. et al. ("Operating Firewalls Outside the LAN Perimeter"), hereinafter 
referred to as Smith. 

5. As per claims 1 and 9, Soha discloses a method of collecting statistics at a 
plurality of measurement points (col. 4, lines 23-31 and lines 41-43). Soha discloses 
the use of multiple monitor units in order to collect statistics and keep track of traffic flow 
(col. 4 lines 37-45). Soha discloses a method of statistics collection, but is silent on the 
statistics analysis in order to reconstruct a path taken by undesirable network traffic. 
However, Smith discloses a method of blocking undesirable network traffic (p. 496, col. 
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2, paragraph 4, lines 1-10). The reconstruction of a path taken by undesirable network 
traffic through the network is considered a method used to block unwanted traffic from 
getting to its destination. It would have been obvious to one of ordinary skill in the art at 
the time of applicant's invention to block undesirable network traffic based on network 
statistics. It is for this reason that one of ordinary skill in the art would have been 
motivated to implement Smith's network unwanted traffic blocking method using a 
statistics collection mechanism disclosed by Soha. 

6. As per claims 2 and 10, in accordance with claims 1 and 9, respectively, Soha 
discloses a network, but is silent on the blocking of undesirable network traffic. 
However, Smith discloses the blocking of undesirable network traffic within a computer 
network (p. 496, col. 2, para. 4, lines 1-10). One with ordinary skill in the art at time of 
applicant's invention would have found it advantageous to use the method disclosed by 
Smith in accordance with the network disclosed by Soha in order to block undesirable 
network traffic. It is for this reason that one of ordinary skill in the art would have been 
motivated to use the network traffic blocking method disclosed by Smith in accordance 
with the network disclosed by Soha. 

7. As per claims 3 and 1 1, in accordance with claims 1 and 9, respectively. Soha 
discloses a network, but is silent on the use of a router. However, Smith discloses the 
use of routers in the forwarding infrastructure (p. 493, col. 2, para. 2). It would have 
been obvious to one of ordinary skill in the art at the time of applicant's invention to use 
a router configuration similar to the one disclosed by Smith in accordance with the 
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network disclosed by Soha. It is for this reason that one of ordinary skill in the art would 
have been motivated to use routers in a fonwarding infrastructure. 

8. As per claims 6 and 14, in accordance with claims 1 and 9, respectively, Smith 
discloses a method of receiving upstream statistics by way of a backward trace (p. 497, 
col. 1 , para. 1 , lines 6-9). Smith also discloses the method of using this information to 
redirect or block the path of the undesirable network traffic (p. 496, col. 2, para. 4). 

9. As per claims 8 and 16, in accordance with claims 1 and 9, Soha discloses the 
use of a computer network, but is silent on whether or not the computer network is 
involved with the Internet. However, Smith discloses a computer network associated 
with the Internet (p. 493, col.1 , para. 1 ). It would have been obvious to one of ordinary 
skill in the art at the time of applicant's invention to use the Internet as the computer 
network as disclosed by Smith in accordance with the statistics gathering network 
method disclosed by Soha. It is for this reason that one of ordinary skill in the art would 
have used the Internet as the computer network. 

10. As per claims 17 and 19, in accordance with claims 1 and 9, respectively. Smith 
discloses undesirable network traffic including denial of service attacks (p. 494, col. 2, 
para. 6 - p. 495, col. 1). 

11. As per claims 18 and 20, in accordance with claims 17 and 19, respectively, it 
would be obvious to one of ordinary skill in the art for the computer network to have 
service providers. It is deemed inherent for a computer network to have service 
provider networks. 
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12. Claims 4, 5, 7, 12, 13, and 15 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Soha (U.S. 4,817,080), hereinafter referred to as Soha, in view of 
Smith, R. N. et al. ("Operating Firewalls Outside the LAN Perimeter"), hereinafter 
referred to as Smith, and in further view of Phaal (U.S. 5,315,580), hereinafter referred 
to as Phaal. 

13. As per claims 4 and 12, in accordance with claims 1 and 9, respectively, Soha 
discloses the use of a network monitoring system in order to gather statistics, but does 
not disclose specific examples of statistics gathered. However, Phaal discloses a 
similar network-monitoring device that collects statistics, including flow-based statistics 
(col. 6, line 48 - col. 7, line 2). It would have been advantageous to one of ordinary skill 
in the art at the time of applicant's invention to gather statistics based on network flow. 
It is for this reason that one of ordinary skill in the art would have found it obvious and 
would have been motivated to gather flow-based statistics. 

14. As per claims 5 and 13, in accordance with claims 1 and 9, respectively, Soha 
discloses the use of packet statistics, but is silent on the use of packet statistics 
providing information about a set of packets. However, Phaal discloses packet statistics 
gathering including information about packets entering the network (col. 6, lines 48-61). 
It would have been obvious to one of ordinary skill in the art at the tinne of applicant's 
invention to utilize the packet statistics method disclosed by Phaal because there are 
many types of statistics that can be derived from a single packet (col. 6, lines 48-51 ). It 
is for this reason that one of ordinary skill in the art would have been motivated to utilize 
the packet statistics gathering method disclosed by Phaal. 
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15. As per claims 7 and 15, in accordance with claims 1 and 9, respectively, Smith 
teaches the method of reconstructing a path taken by undesirable network traffic, but is 
silent on extracting profiles from statistics collection. However, Phaal discloses a 
method of creating profiles from statistics collected by using a traffic matrices (col. 6, 
line 62 - col. 7, line 2) that can be available for analysis (col. 6, lines 44-47). It would 
have been obvious to one of ordinary skill in the art at the time of applicant's invention 
to extract profiles in the form of traffic matrices in order to determine how to redirect 
undesirable network traffic. It is for this reason that one of ordinary skill in the art would 
have been motivated to utilize the traffic matrices disclosed by Phaal to assist in 
reconstructing a path taken by undesirable network traffic. 

Conclusion 

16. The prior art made of record and not relied upon is considered pertinent to 
applicant's disclosure. 

Jinzenji et al. (U.S. 6,032,189) disclose a network data distribution system. 
Conklin et al. (U.S. 5,991,881) disclose a network surveillance system. 
Notess (U.S. 5,231,593) discloses a method of maintaining historical LAN traffic 
statistics. 

Artsy (U.S. 5,701 ,484) discloses a method of routing objects on action paths in a 
distributed computing system. 

Wolff (U.S. 6,067,545) discloses a method of resource rebalancing in networked 
computer systems. 
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Szybicki (U.S. 4,756,019) discloses a method of traffic routing and automatic 
network management system for telecommunication networks. 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Benjamin A. Ailes whose telephone number is 703-305- 
0447. The examiner can normally be reached on Monday-Friday (7:30-4:00). 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor. Jack Harvey can be reached at (703) 305-9705. The fax phone number for 
the organization where this application or proceeding is assigned is (703)308-5358. 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status infornnation for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). 

Communications via Internet e-mail regarding this application, other than those 
under 35 U.S.C. 132 or which othenA^ise require a signature, may be used by the 
applicant and should be addressed to [benjamin.ailes@uspto.gov]. 
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All Internet e-nnail communications will be made of record in the application file. 
PTO employees do not engage in Internet communications where there exists a 
possibility that sensitive information could be identified or exchanged unless the record 
includes a properly signed express waiver of the confidentiality requirements of 35 
U.S.C. 122. This is more clearly set forth in the Interim Internet Usage Policy published 
in the Official Gazette of the Patent and Trademark on February 25, 1997 at 1 195 OG 
89. 

Any inquiry of a general nature or relating to the status of this application or 
proceeding should be directed to Group receptionist whose telephone number is 
(703)305-3900. 




Benjamin Ailes 
Patent Examiner 
Art Unit 2142 



